Data Source
HubSpot is a CRM and marketing platform widely used across sales, marketing, and customer success teams. This connector ingests two log streams from the HubSpot Account Audit Logs v3 API:
- Audit logs - user actions across approvals, content updates, CRM object changes, and administrative activity
- Security activity - login and access events including acting user, IP address, country code, and event type
Ingestion Mechanism
CCF-based (Codeless Connector Framework) using two RestApiPoller connectors polling the HubSpot REST API with Bearer token (APIKey auth type via a HubSpot Private App access token). Both pollers respect HubSpot rate limits via X-HubSpot-RateLimit-* response headers with 429-triggered back-off.
Data flows through DCR into two custom tables:
| Stream | Table | Key fields |
|---|---|---|
| Custom-HubspotAuditLogs_CL | HubspotAuditLogs_CL | ActingUser, Action, Category, SubCategory, TargetObjectId, TimeGenerated |
| Custom-HubspotSecurityActivity_CL | HubspotSecurityActivity_CL | ActingUser, IpAddress, CountryCode, EventType, UserId, TimeGenerated |
The DCR transformKql renames all fields to PascalCase and maps occurredAt / createdAt to TimeGenerated at ingestion time.
Detection Surface Unlocked
Previously, HubSpot user and admin activity was a complete blind spot in Microsoft Sentinel. With this connector deployed, defenders gain visibility into:
- CRM data access and bulk export events (collection/exfiltration risk - T1530, T1213)
- Administrative account changes and permission modifications (T1098)
- Authentication and login events with geo/IP context for impossible travel or credential abuse (T1078)
- Content or template modifications that could indicate supply chain or phishing infrastructure setup
No bundled Analytic Rules or Hunting Queries are included in this initial release. Detection coverage depends on custom KQL written against the two new tables.
Required scope: account-info.security.read on a HubSpot Private App.
Deployment Notes
- Connector is marked preview (isPreview: true)
- Community-supported (no Microsoft SLA)
- The HubspotSecurityActivity_CL poller does not specify a dataCollectionEndpoint or dataCollectionRuleImmutableId in its dcrConfig block - deployments should verify this stream ingests correctly post-deployment
- Audit log poller: page size 100, 5-minute polling window; security activity poller: page size 200, 5-minute polling window
Affected Files
Logos/Hubspot.svg
Solutions/Hubspot/Data Connectors/Hubspot_CCF/Hubspot_DCR.json
Solutions/Hubspot/Data Connectors/Hubspot_CCF/Hubspot_Definition.json
Solutions/Hubspot/Data Connectors/Hubspot_CCF/Hubspot_PollerConfig.json
Solutions/Hubspot/Data Connectors/Hubspot_CCF/Hubspot_Table.json
Solutions/Hubspot/Package/testParameters.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_Hubspot.json, createUiDefinition.json, mainTemplate.json)